Servers:2008:IIS7:mem leak

Every so often 4-6 months
    There is a memory leek in the NPP memory pool at a customer server which causes a IIS to stop responding.

The easiest resolution  is to reboot the server.

Lots of extra analysis would need to be performed to find the root cause. i.e the driver which is causing the memory leek.


The symptoms are

1, Around every 4-6 months the IIS service on the server stops responding. The only way to resolve is to reboot the server.
2, From investigation IIS uses a  NPP Kernal memory. This is used by other drivers on the server. If this runs out IIS will stop responding and will put a message into the http error log ‘connection refused’.
3. Even through all the services connected to IIS are restarted the site still does not respond. This points to a memory leek.
4, IIS uses HTTP.SYS in the NPP memory. Another process is hogging all the memory – used it up. HTTP.SYS needs to use that memory to handle connections.

There are two resolutions to this problem.

1, Automate a reboot of the server every weekend when no one is using it. This will clear out the NPP memory. This assumes the problem driver or process slowly increases it memory usage over time
2, Run through the articles below, find the driver/process, try updating it or remove the program.

KB 177415 - How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks – http://support.microsoft.com/?id=177415
KB 298102 - How to Find Pool Tags that are used by Third-Party Drivers – http://support.microsoft.com/?id=298102